Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Revert "Create non-bypassable op restrictions"" into sc-dev am: b04a005c3f am: 1b75773363

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/14660730

Change-Id: I5b63e2002a15c377acb6ba0fd854eea8b7a58def
This commit is contained in:
Kholoud Mohamed
2021-05-20 10:40:56 +00:00
committed by Automerger Merge Worker
parent 625dd1690b 1b75773363
commit f5c59257b2
4 changed files with 17 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
core/java/android/app/AppOpsManager.java
View File

@@ -7413,18 +7413,8 @@ public class AppOpsManager {
*/ */
public void setUserRestrictionForUser(int code, boolean restricted, IBinder token, public void setUserRestrictionForUser(int code, boolean restricted, IBinder token,
@Nullable Map<String, String[]> excludedPackageTags, int userId) { @Nullable Map<String, String[]> excludedPackageTags, int userId) {
setUserRestrictionForUser(code, restricted, token, excludedPackageTags, userId, false);
}
/**
* An empty array of attribution tags means exclude all tags under that package.
* @hide
*/
public void setUserRestrictionForUser(int code, boolean restricted, IBinder token,
@Nullable Map<String, String[]> excludedPackageTags, int userId, boolean rejectBypass) {
try { try {
mService.setUserRestriction(code, restricted, token, userId, excludedPackageTags, mService.setUserRestriction(code, restricted, token, userId, excludedPackageTags);
rejectBypass);
} catch (RemoteException e) { } catch (RemoteException e) {
throw e.rethrowFromSystemServer(); throw e.rethrowFromSystemServer();
} }

2
core/java/com/android/internal/app/IAppOpsService.aidl
View File

@@ -92,7 +92,7 @@ interface IAppOpsService {
void setAudioRestriction(int code, int usage, int uid, int mode, in String[] exceptionPackages); void setAudioRestriction(int code, int usage, int uid, int mode, in String[] exceptionPackages);
void setUserRestrictions(in Bundle restrictions, IBinder token, int userHandle); void setUserRestrictions(in Bundle restrictions, IBinder token, int userHandle);
void setUserRestriction(int code, boolean restricted, IBinder token, int userHandle, in Map<String, String[]> excludedPackageTags, boolean rejectBypass); void setUserRestriction(int code, boolean restricted, IBinder token, int userHandle, in Map<String, String[]> excludedPackageTags);
void removeUser(int userHandle); void removeUser(int userHandle);
void startWatchingActive(in int[] ops, IAppOpsActiveCallback callback); void startWatchingActive(in int[] ops, IAppOpsActiveCallback callback);

75
services/core/java/com/android/server/SensorPrivacyService.java
View File

@@ -26,6 +26,7 @@ import static android.app.AppOpsManager.OP_CAMERA;
import static android.app.AppOpsManager.OP_PHONE_CALL_CAMERA; import static android.app.AppOpsManager.OP_PHONE_CALL_CAMERA;
import static android.app.AppOpsManager.OP_PHONE_CALL_MICROPHONE; import static android.app.AppOpsManager.OP_PHONE_CALL_MICROPHONE;
import static android.app.AppOpsManager.OP_RECORD_AUDIO; import static android.app.AppOpsManager.OP_RECORD_AUDIO;
import static android.app.AppOpsManager.OP_RECORD_AUDIO_HOTWORD;
import static android.content.Intent.EXTRA_PACKAGE_NAME; import static android.content.Intent.EXTRA_PACKAGE_NAME;
import static android.content.Intent.FLAG_ACTIVITY_EXCLUDE_FROM_RECENTS; import static android.content.Intent.FLAG_ACTIVITY_EXCLUDE_FROM_RECENTS;
import static android.content.pm.PackageManager.PERMISSION_GRANTED; import static android.content.pm.PackageManager.PERMISSION_GRANTED;
@@ -54,7 +55,6 @@ import android.content.Context;
import android.content.Intent; import android.content.Intent;
import android.content.IntentFilter; import android.content.IntentFilter;
import android.content.pm.PackageManager; import android.content.pm.PackageManager;
import android.content.pm.UserInfo;
import android.graphics.drawable.Icon; import android.graphics.drawable.Icon;
import android.hardware.ISensorPrivacyListener; import android.hardware.ISensorPrivacyListener;
import android.hardware.ISensorPrivacyManager; import android.hardware.ISensorPrivacyManager;
@@ -167,8 +167,6 @@ public final class SensorPrivacyService extends SystemService {
private EmergencyCallHelper mEmergencyCallHelper; private EmergencyCallHelper mEmergencyCallHelper;
private KeyguardManager mKeyguardManager; private KeyguardManager mKeyguardManager;
private int mCurrentUser = -1;
public SensorPrivacyService(Context context) { public SensorPrivacyService(Context context) {
super(context); super(context);
mContext = context; mContext = context;
@@ -179,19 +177,6 @@ public final class SensorPrivacyService extends SystemService {
mTelephonyManager = context.getSystemService(TelephonyManager.class); mTelephonyManager = context.getSystemService(TelephonyManager.class);
mSensorPrivacyServiceImpl = new SensorPrivacyServiceImpl(); mSensorPrivacyServiceImpl = new SensorPrivacyServiceImpl();
mUserManagerInternal.addUserLifecycleListener(
new UserManagerInternal.UserLifecycleListener() {
@Override
public void onUserCreated(UserInfo user, Object token) {
setCurrentUserRestriction();
}
@Override
public void onUserRemoved(UserInfo user) {
removeUserRestrictions(user.id);
}
});
} }
@Override @Override
@@ -210,20 +195,6 @@ public final class SensorPrivacyService extends SystemService {
} }
} }
@Override
public void onUserStarting(TargetUser user) {
if (mCurrentUser == -1) {
mCurrentUser = user.getUserIdentifier();
setCurrentUserRestriction();
}
}
@Override
public void onUserSwitching(TargetUser from, TargetUser to) {
mCurrentUser = to.getUserIdentifier();
setCurrentUserRestriction();
}
class SensorPrivacyServiceImpl extends ISensorPrivacyManager.Stub implements class SensorPrivacyServiceImpl extends ISensorPrivacyManager.Stub implements
AppOpsManager.OnOpNotedListener, AppOpsManager.OnOpStartedListener, AppOpsManager.OnOpNotedListener, AppOpsManager.OnOpStartedListener,
IBinder.DeathRecipient, UserManagerInternal.UserRestrictionsListener { IBinder.DeathRecipient, UserManagerInternal.UserRestrictionsListener {
@@ -1386,45 +1357,17 @@ public final class SensorPrivacyService extends SystemService {
} }
private void setUserRestriction(int userId, int sensor, boolean enabled) { private void setUserRestriction(int userId, int sensor, boolean enabled) {
if (userId == mCurrentUser) { if (sensor == CAMERA) {
setCurrentUserRestriction(sensor, enabled); mAppOpsManager.setUserRestrictionForUser(OP_CAMERA, enabled,
mAppOpsRestrictionToken, null, userId);
} else if (sensor == MICROPHONE) {
mAppOpsManager.setUserRestrictionForUser(OP_RECORD_AUDIO, enabled,
mAppOpsRestrictionToken, null, userId);
mAppOpsManager.setUserRestrictionForUser(OP_RECORD_AUDIO_HOTWORD, enabled,
mAppOpsRestrictionToken, null, userId);
} }
} }
private void setCurrentUserRestriction() {
boolean micState = mSensorPrivacyServiceImpl
.isIndividualSensorPrivacyEnabled(mCurrentUser, MICROPHONE);
boolean camState = mSensorPrivacyServiceImpl
.isIndividualSensorPrivacyEnabled(mCurrentUser, CAMERA);
setCurrentUserRestriction(MICROPHONE, micState);
setCurrentUserRestriction(CAMERA, camState);
}
private void setCurrentUserRestriction(int sensor, boolean enabled) {
int[] userIds = mUserManagerInternal.getUserIds();
int code;
if (sensor == MICROPHONE) {
code = OP_RECORD_AUDIO;
} else if (sensor == CAMERA) {
code = OP_CAMERA;
} else {
Log.w(TAG, "Invalid sensor id: " + sensor, new RuntimeException());
return;
}
for (int i = 0; i < userIds.length; i++) {
mAppOpsManager.setUserRestrictionForUser(code, enabled,
mAppOpsRestrictionToken, null, userIds[i], true);
}
}
private void removeUserRestrictions(int userId) {
mAppOpsManager.setUserRestrictionForUser(OP_RECORD_AUDIO, false,
mAppOpsRestrictionToken, null, userId, true);
mAppOpsManager.setUserRestrictionForUser(OP_CAMERA, false,
mAppOpsRestrictionToken, null, userId, true);
}
private final class DeathRecipient implements IBinder.DeathRecipient { private final class DeathRecipient implements IBinder.DeathRecipient {
private ISensorPrivacyListener mListener; private ISensorPrivacyListener mListener;

52
services/core/java/com/android/server/appop/AppOpsService.java
View File

@@ -4568,9 +4568,6 @@ public class AppOpsService extends IAppOpsService.Stub {
// package is exempt from the restriction. // package is exempt from the restriction.
ClientRestrictionState restrictionState = mOpUserRestrictions.valueAt(i); ClientRestrictionState restrictionState = mOpUserRestrictions.valueAt(i);
if (restrictionState.hasRestriction(code, packageName, attributionTag, userHandle)) { if (restrictionState.hasRestriction(code, packageName, attributionTag, userHandle)) {
if (restrictionState.rejectBypass(code, userHandle)) {
return true;
}
RestrictionBypass opBypass = opAllowSystemBypassRestriction(code); RestrictionBypass opBypass = opAllowSystemBypassRestriction(code);
if (opBypass != null) { if (opBypass != null) {
// If we are the system, bypass user restrictions for certain codes // If we are the system, bypass user restrictions for certain codes
@@ -6152,8 +6149,6 @@ public class AppOpsService extends IAppOpsService.Stub {
for (int j = 0; j < restrictionCount; j++) { for (int j = 0; j < restrictionCount; j++) {
int userId = restrictionState.perUserRestrictions.keyAt(j); int userId = restrictionState.perUserRestrictions.keyAt(j);
boolean[] restrictedOps = restrictionState.perUserRestrictions.valueAt(j); boolean[] restrictedOps = restrictionState.perUserRestrictions.valueAt(j);
boolean[] rejectBypassOps =
restrictionState.perUserRejectBypasses.valueAt(j);
if (restrictedOps == null) { if (restrictedOps == null) {
continue; continue;
} }
@@ -6178,9 +6173,6 @@ public class AppOpsService extends IAppOpsService.Stub {
restrictedOpsValue.append(", "); restrictedOpsValue.append(", ");
} }
restrictedOpsValue.append(AppOpsManager.opToName(k)); restrictedOpsValue.append(AppOpsManager.opToName(k));
if (rejectBypassOps != null && rejectBypassOps[k]) {
restrictedOpsValue.append(" rejectBypass=true");
}
} }
} }
restrictedOpsValue.append("]"); restrictedOpsValue.append("]");
@@ -6261,14 +6253,14 @@ public class AppOpsService extends IAppOpsService.Stub {
String restriction = AppOpsManager.opToRestriction(i); String restriction = AppOpsManager.opToRestriction(i);
if (restriction != null) { if (restriction != null) {
setUserRestrictionNoCheck(i, restrictions.getBoolean(restriction, false), token, setUserRestrictionNoCheck(i, restrictions.getBoolean(restriction, false), token,
userHandle, null, false); userHandle, null);
} }
} }
} }
@Override @Override
public void setUserRestriction(int code, boolean restricted, IBinder token, int userHandle, public void setUserRestriction(int code, boolean restricted, IBinder token, int userHandle,
Map<String, String[]> excludedPackageTags, boolean rejectBypass) { Map<String, String[]> excludedPackageTags) {
if (Binder.getCallingPid() != Process.myPid()) { if (Binder.getCallingPid() != Process.myPid()) {
mContext.enforcePermission(Manifest.permission.MANAGE_APP_OPS_RESTRICTIONS, mContext.enforcePermission(Manifest.permission.MANAGE_APP_OPS_RESTRICTIONS,
Binder.getCallingPid(), Binder.getCallingUid(), null); Binder.getCallingPid(), Binder.getCallingUid(), null);
@@ -6284,12 +6276,11 @@ public class AppOpsService extends IAppOpsService.Stub {
} }
verifyIncomingOp(code); verifyIncomingOp(code);
Objects.requireNonNull(token); Objects.requireNonNull(token);
setUserRestrictionNoCheck(code, restricted, token, userHandle, excludedPackageTags, setUserRestrictionNoCheck(code, restricted, token, userHandle, excludedPackageTags);
rejectBypass);
} }
private void setUserRestrictionNoCheck(int code, boolean restricted, IBinder token, private void setUserRestrictionNoCheck(int code, boolean restricted, IBinder token,
int userHandle, Map<String, String[]> excludedPackageTags, boolean rejectBypass) { int userHandle, Map<String, String[]> excludedPackageTags) {
synchronized (AppOpsService.this) { synchronized (AppOpsService.this) {
ClientRestrictionState restrictionState = mOpUserRestrictions.get(token); ClientRestrictionState restrictionState = mOpUserRestrictions.get(token);
@@ -6303,7 +6294,7 @@ public class AppOpsService extends IAppOpsService.Stub {
} }
if (restrictionState.setRestriction(code, restricted, excludedPackageTags, if (restrictionState.setRestriction(code, restricted, excludedPackageTags,
userHandle, rejectBypass)) { userHandle)) {
mHandler.sendMessage(PooledLambda.obtainMessage( mHandler.sendMessage(PooledLambda.obtainMessage(
AppOpsService::notifyWatchersOfChange, this, code, UID_ANY)); AppOpsService::notifyWatchersOfChange, this, code, UID_ANY));
mHandler.sendMessage(PooledLambda.obtainMessage( mHandler.sendMessage(PooledLambda.obtainMessage(
@@ -6834,10 +6825,8 @@ public class AppOpsService extends IAppOpsService.Stub {
private final class ClientRestrictionState implements DeathRecipient { private final class ClientRestrictionState implements DeathRecipient {
private final IBinder token; private final IBinder token;
SparseArray<boolean[]> perUserRestrictions; SparseArray<boolean[]> perUserRestrictions;
SparseArray<boolean[]> perUserRejectBypasses;
SparseArray<Map<String, String[]>> perUserExcludedPackageTags; SparseArray<Map<String, String[]>> perUserExcludedPackageTags;
public ClientRestrictionState(IBinder token) public ClientRestrictionState(IBinder token)
throws RemoteException { throws RemoteException {
token.linkToDeath(this, 0); token.linkToDeath(this, 0);
@@ -6845,17 +6834,13 @@ public class AppOpsService extends IAppOpsService.Stub {
} }
public boolean setRestriction(int code, boolean restricted, public boolean setRestriction(int code, boolean restricted,
Map<String, String[]> excludedPackageTags, int userId, boolean rejectBypass) { Map<String, String[]> excludedPackageTags, int userId) {
boolean changed = false; boolean changed = false;
if (perUserRestrictions == null && restricted) { if (perUserRestrictions == null && restricted) {
perUserRestrictions = new SparseArray<>(); perUserRestrictions = new SparseArray<>();
} }
if (perUserRejectBypasses == null && rejectBypass) {
perUserRejectBypasses = new SparseArray<>();
}
int[] users; int[] users;
if (userId == UserHandle.USER_ALL) { if (userId == UserHandle.USER_ALL) {
// TODO(b/162888972): this call is returning all users, not just live ones - we // TODO(b/162888972): this call is returning all users, not just live ones - we
@@ -6915,20 +6900,6 @@ public class AppOpsService extends IAppOpsService.Stub {
} }
changed = true; changed = true;
} }
boolean[] userRejectBypasses = perUserRejectBypasses.get(thisUserId);
if (userRejectBypasses == null && rejectBypass) {
userRejectBypasses = new boolean[AppOpsManager._NUM_OP];
perUserRejectBypasses.put(thisUserId, userRejectBypasses);
}
if (userRejectBypasses != null
&& userRejectBypasses[code] != rejectBypass) {
userRejectBypasses[code] = rejectBypass;
if (!rejectBypass && isDefault(userRejectBypasses)) {
perUserRejectBypasses.remove(thisUserId);
}
changed = true;
}
} }
} }
} }
@@ -6966,17 +6937,6 @@ public class AppOpsService extends IAppOpsService.Stub {
return !ArrayUtils.contains(excludedTags, attributionTag); return !ArrayUtils.contains(excludedTags, attributionTag);
} }
public boolean rejectBypass(int restriction, int userId) {
if (perUserRejectBypasses == null) {
return false;
}
boolean[] rejectBypasses = perUserRejectBypasses.get(userId);
if (rejectBypasses == null) {
return false;
}
return rejectBypasses[restriction];
}
public void removeUser(int userId) { public void removeUser(int userId) {
if (perUserExcludedPackageTags != null) { if (perUserExcludedPackageTags != null) {
perUserExcludedPackageTags.remove(userId); perUserExcludedPackageTags.remove(userId);